CVE-2026-0994

[chickahoona]

Vulnerability scanners currently blocking and fail build pipelines due to due to CVE-2026-0994.
There seems to be a fix here #25239 (not sure how good or bad it is)

Any help to create a fix for this problem would be well appreciated!

[DhavalGojiya]

👀

[lucas42]

I think this is a duplicate of #25070

[chickahoona]

Has been fixed with 6.33.5 as far as I understood., so closing the issue.

[OllieMilky]

Just checking if anyone is facing issues with version 6.33.5 still failing Snyk security scanning for this?
https://security.snyk.io/package/pip/protobuf

[OllieMilky]

Update to my own question ^ filed a report with Snyk and the package now shoes no vulnerabilities!

[obs-gh-nikhildua]

@chickahoona Is there any plans to bring this to version 4.25.x? We run a cloud function which depends on this version and updating will cause backwards incompatibility with other library versions as well for our customers.

[chickahoona]

@obs-gh-nikhildua I think you have the wrong person. I am just a regular user of this library. You should reach out to a contributor for this ;)

[schmod]

Is there any plan to backport the fix to v4.x.x?